CVE-2015-8771

CVE-2015-8771 affects GOsa: the generate_smb_nt_hash function in include/functions.inc allows a remote attacker to execute arbitrary commands via a crafted password. Multiple connected sources (CNVD, OSS/OSV equivalents, Debian advisories, and NVD entry) corroborate the same issue. The vulnerabil...

CVE-2015-8771

The generatesmbnthash function in include/functions.inc in GOsa allows remote attackers to execute arbitrary commands via a crafted password...

GLSA-201702-05 : Lsyncd: Remote execution of arbitrary code

The remote host is affected by the vulnerability described in GLSA-201702-05 Lsyncd: Remote execution of arbitrary code default-rsyncssh.lua in Lsyncd performed insufficient sanitising of filenames. Impact : An attacker, able to control files processed by Lsyncd, could possibly execute arbitrary...

Lsyncd: Remote execution of arbitrary code

Background A daemon to synchronize local directories using rsync. Description default-rsyncssh.lua in Lsyncd performed insufficient sanitising of filenames. Impact An attacker, able to control files processed by Lsyncd, could possibly execute arbitrary code with the privileges of the process or...

Input validation

Multiple incomplete blacklist vulnerabilities in inc/core/class.dc.core.php in Dotclear before 2.8.2 allow remote authenticated users with "manage their own media items" and "manage their own entries and comments" permissions to execute arbitrary PHP code by uploading a file with a 1 .pht, 2 .php...

CVE-2016-10190

Heap-based buffer overflow in libavformat/http.c in FFmpeg before 2.8.10, 3.0.x before 3.0.5, 3.1.x before 3.1.6, and 3.2.x before 3.2.2 allows remote web servers to execute arbitrary code via a negative chunk size in an HTTP response...

CVE-2015-6024

ping.cgi in NetCommWireless HSPA 3G10WVE wireless routers with firmware before 3G10WVE-L101-S306ETS-C01R05 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the DIAIPADDRESS parameter...

CVE-2016-10192

Heap-based buffer overflow in ffserver.c in FFmpeg before 2.8.10, 3.0.x before 3.0.5, 3.1.x before 3.1.6, and 3.2.x before 3.2.2 allows remote attackers to execute arbitrary code by leveraging failure to check chunk size...

CVE-2016-10190

Heap-based buffer overflow in libavformat/http.c in FFmpeg before 2.8.10, 3.0.x before 3.0.5, 3.1.x before 3.1.6, and 3.2.x before 3.2.2 allows remote web servers to execute arbitrary code via a negative chunk size in an HTTP response...

CVE-2016-10190

Heap-based buffer overflow in libavformat/http.c in FFmpeg before 2.8.10, 3.0.x before 3.0.5, 3.1.x before 3.1.6, and 3.2.x before 3.2.2 allows remote web servers to execute arbitrary code via a negative chunk size in an HTTP response...

The vulnerabilities of PDF viewer programs such as Adobe Reader and Document Cloud, as well as PDF editing programs like Adobe Acrobat Document Cloud and Adobe Acrobat, allow attackers to execute arbitrary code.

The vulnerability in the XSLT programs for PDF viewing applications such as Adobe Reader and Document Cloud, as well as in PDF editing programs like Adobe Acrobat Document Cloud and Adobe Acrobat, is related to improper type conversion. Exploiting this vulnerability allows an attacker to execute...

The vulnerability of the Flash Player software, which allows a violator to execute arbitrary code

The vulnerability of the JPEG XR component in the Adobe Flash Player software arises from an operation that goes beyond the buffer boundaries in memory. Exploiting this vulnerability allows a malicious actor to execute arbitrary code memory corruption remotely...

Code injection

IBM Tivoli Endpoint Manager could allow a remote attacker to upload arbitrary files. A remote attacker could exploit this vulnerability to upload a malicious file. The only way that file would be executed would be through a phishing attack to trick an unsuspecting victim to execute the file...

CVE-2016-8418

A remote code execution vulnerability in the Qualcomm crypto driver could enable a remote attacker to execute arbitrary code within the context of the kernel. This issue is rated as Critical due to the possibility of remote code execution in the context of the kernel. Product: Android. Versions:...

MetalGenix GeniXCMS SQL Injection Vulnerability (CNVD-2017-01320)

MetalGenix GeniXCMS is a PHP-based content management system and framework CMSF from MetalGenix Indonesia, which provides modules for user management, content management and menu management. A SQL injection vulnerability exists in the inc/lib/Options.class.php file in MetalGenix GeniXCMS 0.0.8 an...

Apache OpenOffice Text Document Malicious Macro Execution

This module generates an Apache OpenOffice Text Document with a malicious macro in it. To exploit successfully, the targeted user must adjust the security level in Macro Security to either Medium or Low. If set to Medium, a prompt is presented to the user to enable or disable the macro. If set to...

Multiple Cross-Site Scripting Vulnerabilities in ZoneMinder

ZoneMinder is a security monitoring software for cameras. ZoneMinder suffers from multiple cross-site scripting vulnerabilities that allow an attacker to remotely execute malicious scripts in the browser of an authenticated client...

Debian: Security Advisory (DSA-3783-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2017-5367

CVE-2017-5367 corresponds to multiple reflected XSS vulnerabilities in ZoneMinder (versions 1.30 and 1.29) where parameters in /zm/index.php can be manipulated to execute scripts in an authenticated user’s browser. Affected components include various query parameters (e.g., action, view, filter, ...

Microsoft Waits for Patch Tuesday to Fix SMB Zero Day

Microsoft will not rush out an emergency patch for a zero-day vulnerability disclosed on Wednesday in the Windows implementation of the Server Message Block protocol. Researcher Laurent Gaffie announced in a tweet, below, that he’d found a zero-day vulnerability in SMBv3 and released a...